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Abstract 

The squashed entanglement of a quantum channel is an additive function of quantum chan¬ 
nels, which finds application as an upper bound on the rate at which secret key and entanglement 
can be generated when using a quantum channel a large number of times in addition to unlim¬ 
ited classical communication. This quantity has led to an upper bound of log((l -I- if)/{I — t])) 
on the capacity of a pure-loss bosonic channel for such a task, where t] is the average fraction of 
photons that make it from the input to the output of the channel. The purpose of the present 
paper is to extend these results beyond the single-sender single-receiver setting to the more gen¬ 
eral case of a single sender and multiple receivers (a quantum broadcast channel). We employ 
multipartite generalizations of the squashed entanglement to constrain the rates at which secret 
key and entanglement can be generated between any subset of the users of such a channel, along 
the way developing several new properties of these measures. We apply our results to the case 
of a pure-loss broadcast channel with one sender and two receivers. 


1 Introduction 

Quantum key distribution (QKD) refers to the quantum communication task of generating a shared 
secret key between two or more cooperating parties that is information-theoretically secure against 
an all-powerful eavesdropper miiQ]. The security of QKD is based on physical principles, guar¬ 
anteed by the laws of quantum mechanics. QKD protocols such as BB84 [3], Ekert91 |18) and 
CVGG02 [22] have been studied both theoretically and experimentally over many years since the 
original BB84 proposal. 

Practical implementations of QKD over point-to-point fibre optical links are known to suffer 
from an exponential decay of the secret key rate with increasing distance of communication. Re¬ 
cently, it has been proven mathematically that key distillation over a pure-loss bosonic channel 
is fundamentally constrained by such a rate-loss trade-off |43l 132] , which cannot be circumvented 
unless augumented by the use of quantum repeaters muss], for which we do not yet have an op¬ 
erational implementation. The primary mathematical tool used in [431132] to establish this result 
is an entanglement measure known as the squashed entanglement [13]. (See also the related works 
[451138] ■) The squashed entanglement possesses nearly all the desired properties of an entanglement 
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measure [niEiisniE]. From this measure, one can construct a function of a channel known as the 
squashed entanglement of the channel |43j . which is defined as the maximum squashed entangle¬ 
ment that can be generated between the input and output of the channel. The idea behind these 
quantities stems from classical information theory, being inspired by the intrinsic information [35], 
which can be seen by tracing their roots to earlier work in |10j . 

Going forward from the results of [431 02] j a natural question of interest is to determine rate- 
loss trade-offs in a multi-user setting, e.g., in a setting with one sender and multiple receivers. 
While one possibility is to consider optical switches or wavelength-division multiplexing between the 
transmitter and each of the receiver nodes, such an architecture would be prohibitively expensive, 
owing to the need to have a full QKD system for each node. Alternatively, architectures based 
on point-to-multipoint links, modeled as quantum broadcast channels, have been suggested to 
accomplish secure multinode networks jU]. Indeed we cannot hope to circumvent the already 
established rate-loss trade-offs when going to these settings, simply because one could always obtain 
an upper bound on the achievable rates in such a setting by grouping all receivers together as a 
single receiver. Nevertheless, we can hope to refine our understanding of the rate-loss trade-off. 
The main purpose of the present paper is to accomplish just that for a quantum broadcast channel 
connecting a single sender to an arbitrary number of receivers. 

The secret-key agreement capacity of a noisy quantum channel is defined as the highest rate 
at which arbitrarily secure secret-key bits can be generated by using the channel an arbitrarily 
large number of times in addition to unlimited forward and backward classical communication. 
This capacity was first considered in the classical context in and later on in the more general 

quantum context. Similarly, a related quantity—the entanglement distillation capacity of a channel, 
is defined as the highest rate at which entanglement can be generated using the channel many 
times. Note that both of these definitions include “direct” communication: the secret key generated 
combined with unlimited classical communication allows for secure communication via the one-time 
pad protocol and the entanglement generated combined with the classical communication allows 
for quantum communication via the teleportation protocol [5]. 

In this work, we establish constraints on the secret-key agreement capacity and the entangle¬ 
ment distillation capacity of a quantum broadcast channel. Our bounds are based on multipartite 
generalizations of the squashed entanglement mm and constrain the rates at which secret key or 
entanglement can be established between any subset of the users of a quantum broadcast channel. 
For an example, see Theorem 12 for our upper bounds on a single-sender two-receiver broadcast 
channel. It should be noted that the capacity of the quantum broadcast channel has been explored 
in several contexts, including classical communication |23l HU [371 ES] and private and quantum 
communication [161156) . However, prior to our work, no nontrivial upper bound had been estab¬ 
lished for the secret-key agreement and entanglement distillation capacity of a quantum broadcast 
channel assisted by unlimited classical communication between all parties. 

The paper is organized as follows. We begin by recalling some preliminary notions in Sec¬ 
tion [^ As part of the preliminaries, we include a brief review of the squashed entanglement and 
its multipartite generalizations in Section |2.6[ In Section [^ we prove some new auxiliary lemmas 
regarding several multipartite squashed entanglements, which play important roles in our main 
theorem. Following that, we introduce the quantum broadcast channel in Section [^ and describe a 
protocol for secret-key agreement and entanglement distillation over such a channel. In Section [^ 
we give upper bounds on the achievable secret-key agreement and entanglement distillation rates 
over a single-sender, two-receiver quantum broadcast channel. Following that, in Section]^ we give 
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our general theorem constraining the rates at which secret-key agreement and entanglement distil¬ 
lation are possible when using a quantum broadcast channel with one sender and m receivers. In 
Section we apply our results to a single-sender, two-receiver bosonic broadcast channel. Finally, 
we summarize with a conclusion. 

2 Preliminaries 

2.1 States, systems, channels, and measurements 

Let B{T-L) denote the algebra of bounded linear operators acting on a Hilbert space H. Let 
denote the subset of positive semi-definite operators. An operator p is a density operator, represent¬ 
ing the state of a quantum system, if p G B{J-L)j^ and Tr {p} = 1. Let SiT-L) denote the set of density 
operators acting on %. We also use the term “quantum state” or just “state” interchangeably with 
the term “density operator.” The tensor product T-La <8) Hb of two Hilbert spaces Ha and "Hb is 
also denoted by T-Lab- Given a multipartite density operator pab £ <S{T-Iab), the reduced density 
operator on system A is written in terms of the partial trace as pA = T^b {pab}- An extension of 
a state pA £ 3(1-1 a) is a state Hba £ 3{Hra) such that Ttb = PA- 

A linear map Ma^b '■ B(Ha) —>• B{Hb) is positive if MA^Bi^'A) £ B(Hb)+ whenever aA £ 
B{Ha)+- Let id^ denote the identity map acting on a system A. A linear map Ma-^b is completely 
positive if the map idjj ® Ma-^b is positive for a reference system R of arbitrary size. A linear 
map Ma^b is trace-preserving if Av{Ma-^b ("rA)} = Tr{rA} for all input operators ta G B{J-La)- A 
linear map is a quantum channel if it is both completely positive and trace-preserving (CPTP). An 
isometric extension of a channel Ma^b acting on a state pA £ S{1-La) is a linear map that 

satishes the following: 

AvE[uj[^BEPA{U^^BE)^}=^A^B(pA), = Ia, UmUI = Ube, ( 2 . 1 ) 

where Hbb is a projection onto a subspace of the Hilbert space Rb ® He- 

A measurement channel is a quantum channel with a quantum input and a classical output, 
specihed as follows: 

w —^ ^TrlA^w} |m)(m|, (2.2) 

m 

where {A”*} is a set of positive semi-definite operators such that ~ ^ {l^)} is an 

orthonormal basis. The set {A”^} is also known as a positive operator-valued measure (POVM). 

2.2 Maximally entangled states and GHZ states 

Along with density operators, we also say that any unit vector IV') G is a quantum state. Its 
corresponding density operator is |'0)(V’|, and we often make the abbreviation ?/) = Any 

bipartite pure state \'4^)ab £ Rab has a Schmidt decomposition as follows: 

d-l 

|V’)ab = ^ \/AiN)A|i)B, (2.3) 

i=0 

where {|i)A} and {|i) b} form orthonormal bases in Ra and Rb, respectively, d is the Schmidt rank 
of the state, 0 < Aj < 1 for alH G {0,..., d — 1}, and Yli=o ^ maximally entangled state 
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of Schmidt rank d is a pure bipartite state of the following form: 



i=0 


(2.4) 


and is said to contain H = — Tr log = log d entangled bits. In the previous expression, 
H denotes the von Neumann entropy of the reduced state <1>^ = Tr^ {‘hAB}- 

The Greenberger-Horne-Zeilinger (GHZ) state is a multipartite generalization of the maximally 
entangled state. An m-party GHZ state shared between systems Ai,..., Am is written as 


rf-i 



(2.5) 


where {|i)Ai }5 •••, {1*)^^} orthonormal bases, and is also said to contain logd entangled 
bits. Throughout this paper, we refer to GHZ states \^)Ai--A m niaximally entangled states 
(however, note that this terminology depends on which entanglement measure one employs—for 
the entanglement measures that we employ in this paper, they are indeed maximally entangled). 

2.3 Bipartite and multipartite private states 

Let 7 asa'S' be a state shared between spatially separated parties Alice and Bob, such that Alice 
possesses systems A and A' and Bob possesses systems B and B'. jabA'S' is called a private state 
|261 Wf\ if Alice and Bob can extract a secret key from it by performing local measurements on A 
and B, which is product with any purifying system of 'JabA'B'- That is, 'JabA'B' is a private state 
of logd private bits if, for any purification \^'^)abA'B'E IABA'BA the following holds: 



where AI(-) = K)(^I(')K)(*I is a von Neumann measurement channel and cte is some state on the 

purifying system E (which could depend on the particular purification). The systems A' and B' are 
known as “shield systems” because they aid in keeping the key secure from any party possessing 
the purifying system (part or all of which might belong to a malicious party). It is a non-trivial 
consequence of the above definition that a private state of log d private bits can be written in the 
following form [MIEZ]: 


lABA'B' = UaBA'B' {^AB ® PA'B') ^\bA'B'^ (^■’^) 

where ^ab is a maximally entangled state of Schmidt rank d, and 

d-l 


ABA'B'’ 


(2.7) 



i,j=0 


is a controlled unitary known as a “twisting unitary.” The advantage of the notion of a private state 
shared between Alice and Bob as opposed to a secret key is that there is no need to consider an 
eavesdropper in the private state formalism, as where this is necessary when considering a secret 


key. We return to this point in Section 2.4 
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A multipartite private state is a straightforward generalization of the bipartite definition [28]. 
Indeed, is a state of logd private bits if, for any purification \^'^) Ax---AmA' ■■■A' E 

lAx--AmAE--A'^-: following holds: 


[Max®---®Ma^®T^^A'^-A'S) (/‘ax-a^ae-A'^i^ =\'^\i){i\Ax®---^\'i){i\Arr,®<rE, (2.9) 

i=0 

where Ai and a are as before. The above implies that an m-partite private state of log d private 
bits is a quantum state 'jAx---A,nA[---A'^ can be written as 

lAx-A^AE-A'^ = Uax-A^AE-A'^ {^Ax-A^ ® PA'x-A'^) U\^...Ar^A',-A'^^ 
where ^Ax-Am is an m-qudit maximally entangled state and 

d-l 

UAx---AmA\---A'^= Kl) • • • ) • • • , ® (2T1) 

is a twisting unitary, where each unitary UA’"'’IT depends on the values ii,..., im- 

Note that for brevity of notation, we sometimes suppress the shield systems when writing a 
private state. In such a case, it is implicit that the shield systems are contained within; e.g., the 
notation 'jab implies that system A contains both Alice’s share of the key and a shield and likewise 
B contains both Bob’s share of the key and a shield. 


2.4 LOCC and LOPC 


Local operations and classical communication (LOCC) is a commonly considered paradigm for 
distributed quantum information processing between two or more honest parties [H] (for a recent 
discussion, see, e.g., m)- In this paradigm, m cooperating parties Ai,, Am begin by sharing a 
quantum state pAx-Am- They are subsequently allowed to perform local quantum operations on 
their own systems and to communicate with each other using a classical communication channel. 
A typical goal of an LOCC protocol is to distill a GHZ entangled state or a multipartite private 
state. 

Local operations and public communication (LOPC) is a related paradigm that is particularly 
relevant for quantum key distribution [261 127) . In this paradigm, we have the honest parties 
Ai,... ,Am and an additional untrusted party E. All parties begin by sharing a quantum state 
PAx-AmE, and the honest parties are allowed to perform local quantum operations and public 
classical communication, such that all parties have access to the classical data being communicated 
over a public classical channel. The public classical channel is “authenticated,” meaning that the 
untrusted party can only learn the classical information but is not allowed to tamper with it. 
The usual aim of the trusted parties in the LOPC paradigm is to distill a state that is nearly 


indistinguishable from a secret key state of the form in (2.9). 


One of the main insights of [261127] was to prove that the approximate LOCC distillation of 
private states is equivalent to the approximate LOPC distillation of a secret key, when we are dealing 
with the “most paranoid” scenario in which the untrusted party possesses a purifying system of 
the states of the honest parties. Thus, this result introduces an important simplification in which 
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it suffices to focus on the LOCC distillation of private states. Also, we can unify this setting with 
entanglement distillation, in which the goal of a given protocol could be to distill both entangled 
states and private states at the same time. This is exactly the kind of scenario that we will consider 
in this paper. 

2.5 Conditional mutual information and conditional multipartite information 

Let pabe be a tripartite quantum state on systems A, B, and E. The quantum conditional mutual 
information (QCMI) is defined as 


/(A; B\E)p = H{AE)p + H{BE)p - H{E)p - H{ABE) 


P’ 


( 2 . 12 ) 


where, e.g., H{AE)p = — Tr logp^s} denotes the von Neumann entropy of the state pae, 
which is the reduced density operator pae = {pabe}- The QCMI is non-negative, which is 
a non-trivial fact known as the strong subadditivity of quantum entropy [321 EH- The QCMI is 
non-increasing under the action of local quantum channels performed on the systems A and B US], 
i.e., 

I{A;B\E)p>IiA';B'\E)^, (2.13) 

where uja'B'E = ® -Mb^B') {pabe) with Ma^A' and Mb^B' arbitrary local quantum 

channels performed on the input systems A and B, leading to output systems A' and B', respec¬ 
tively. Another interesting property of the QCMI is that for a four-party pure state if }abed it 
obeys a duality relation given by I{A]B\E)^ = I{A]B\D)^ [151 ESj- The QCMI finds an opera¬ 
tional meaning in the information theoretic task of quantum state redistribution m- 

For an m-|- 1-partite quantum state PAi--AmE, there are at least two distinct ways to generalize 
the conditional mutual information: 


I(Ai; • • • ; A^\E)p = H{Ai\E) - H{Ai • • • Am\E)p, 

i=l 

m 

/(Ai; • • • ; Am\E)p = 'y ^ H{^A^^Y\{i}\^)p ~ (^ “ 1) H{Ai ■ ■ ■ Am\E)p 

i=l 

m 

~ H[Ai ■ ■ ■ Am\E)p — y ^ iL(Aj|A|'^jy|j|il/)p, 


(2.14) 

(2.15) 

(2.16) 


i=l 


where the shorthand A[^]\|j| indicates all systems Ai • • • A^ except for system AjQ The former 
is the conditional version of a quantity known as the total correlation m and has been used in 
a variety of contexts [MIEIIIH], while the latter was introduced in [8] and employed later on in 
[. The above two quantities are generally incomparable, but related by the following formula 


/(Ai; • • • ; Ajji\E)p -|- /(Ai; • • • ; Am\E)p — y ^ /(A*; |i?)^ 


(2.17) 


2=1 


^In previous work [S], the quantity I{Aa • • • ; Am\E)p was denoted by • • • ; Am\E)p, but there are at least 

two difficulties with using this notation. First and foremost, the letter S is widely used in quantum physics to denote 
entropy or uncertainty, while the measure here is not a measure of uncertainty but rather of correlations. Second, 
having the subscript m limits the extension of the notation to the more general scenarios considered in this paper 


(c.f., Section 2.71. 
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For a state PBAiA 2 --AmE, the above conditional multipartite informations obey the following chain 
rules, respectively [53l Section III]: 


m 

I{BAv, • • • ; A^\E)p = I{Ai; • • • ; Am\BE)p + ^ I{B; Ai\E)p, (2.18) 

i=2 

I{BAi]A 2--- ] Am\E) p = I {A\] A 2 ] ■ ■ ■ ] Am\BE) p + I{B] A 2 ■ ■ ■ Am\E)p. (2-19) 

Also, they are additive with respect to tensor-product states, non-negative, and monotone non¬ 
increasing under local quantum channels acting on systems Ai,..., [53l Section III], i.e., 

/(Ai; • • • ; Am\E)p > /(A)^; • • • ; A'^\E)i^^ (2.20) 

/(Ai; • • • ; Am\E)p > /(A)^; • • • ; A'^\E)^^ (2-21) 

where 

® ■ ■ ■ ® {PA,-A„E) , (2.22) 


rii) 

with At an arbitrary local quantum channel performed on the input system Aj, leading to 

output system A'. 


2.6 Bipartite and multipartite squashed entanglement 

We begin this section by recalling the definition of the bipartite squashed entanglement m- 


Definition 1 The squashed entanglement of a bipartite state pab is defined as 


£'sq(A; B)p = I- inf {/(A; B\E)uj : Trg {u;abe} = Pab} 
Z lAtABE 


(2.23) 


where the infimum is taken over all possible extensions uiabe of pab ond I{A] B\E)i^ is the quantum 
conditional mutual information of (2.12). 


The squashed entanglement possesses many of the properties that are desired of an entanglement 
measure. For example, it is monotone non-increasing under LOCC, additive with respect to tensor- 
product states, and subadditive in general m- It is a faithful entanglement measure, in the 
sense that it is equal to zero if and only if the state is separable laisni. It is also asymptotically 
continuous [2]. The squashed entanglement is normalized on maximally entangled states and private 
states: for a maximally entangled state of Schmidt rank d, the squashed entanglement equals logd 
m, and it is at least log d for a private state of log d private bits m Proposition 4.19]. Furthermore, 
the squashed entanglement of a state pab is an upper bound on the rate at which Bell states or 
private states can be distilled per copy of pab when using LOCC [13 Eg. 

There are at least two different multipartite generalizations of the squashed entanglement [531 [3]: 


Definition 2 For an m-partite quantum state PAi---Am! squashed entanglement measures Esq 
and Esq are defined as 


T'sq(Ai; • • 

••A ) =1 

5 ^mjp — ^ 

inf 

U(Ai;-- 

* ; -^m lE'jco ' 

: Tie = PAi-Am} , 

(2.24) 

2 

^AiA2---AYfiE 





A'sq(Ai; • • 

••A ) 

) ^mjp — 2 

inf 

^A-\^A2---AmE 

{/(Ai;-- 


: TlEioJAi-ArnE} = PAi-A^I , 

(2.25) 
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where the infima are taken over all possible extensions ojA- i^-AmE of pA^-AmJ ond I and I are the 
quantum conditional multipartite information quantities given in (2.14) and (2.15), respectively. 

The squashed entanglements defined above have the following alternative characterization in 
terms of a “squashing channel,” which follows from the same reasoning that justifies m Eq. (3)]: 

Lemma 3 Let \^^)a,...a e a purification of pai-a^- Then 


E'sq(Ai; • • 

III 

^ inf I{Ap-- 

■ ) Am\E )[j. 

(2.26) 

E'sq(Ai; • • 

III 

^ inf I(Ai;-- 

^ ^E^E' 

■ ) Am\E )(j. 

(2.27) 


where the infima are over all squashing channels Se^e' oind 

OJA^-A^E' = SE^E'{vA^...ArnE) 


(2.28) 


The above multipartite squashed entanglements are both monotone non-increasing under LOCC, 
additive with respect to tensor-product states, subadditive in general, and asymptotically contin¬ 
uous |53l Section IV]. They both reduce to the bipartite squashed entanglement from Definition 
when m = 2. They also satisfy the following lemmas: 


'Bm ’ 


Lemma 4 ]5tA Section IV-A] For a classical-quantum state 

PxABi-B^ = '^pxix)\x){x\x <S) Pab,- 

X 

the squashed entanglement measures of Definition^ satisfy the following property: 

E'sq(^V; Bi] • • • ; .Bm)p — ^ ^ p{x)Egq(^A', B \| • • • ; , 

X 

Esq{AX-,Bi; • • • ; Bm)p = '^p{x)Esq{A; Bp,-- - ;Bn 


■*m ) p-^ 


(2.29) 

(2.30) 

(2.31) 


Lemma 5 Observation 1] Let ^Ai-Am be a maximally entangled GHZ state of Schmidt rank 
d. Then 

~ 771 

-Esq(^i; ■ ■ ■ ) ^m)<i> — E/sq(j4i; • • • ; log d. (2.32) 


Let 'jAi-.-Am be a private state, such that each key system has dimension d. Then 


mm 
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Esq{Ai,--- , AfYif, Egql^Ai, • • • ,^jn)q,j’ ^ — log d. 


(2.33) 


2.7 Shorthand for multipartite information measures in terms of partitions 

A partition ^ of a set /C is a set of non-empty subsets of K, such that 

[jx = K 

x&g 


(2.34) 




and for all Xi, X 2 ^ Q 


(2.35) 


XinX2 = 0. 

For example, if /C = {A, B, C}, then Q = {{^} , {B, C}} is a partition of JC. 

The power set 'P(/C) of a set JC is the set of all subsets of 1C. Let 'P>i(/C) and V> 2 {JC) denote 
the set of all non-empty subsets of 1C and the set of all non-empty and non-singleton subsets of /C, 


respectively. For example, if /C = {A,B,C}, then 

V{1C) = {0, {A} , {B} , {C} , {A, C} , {^, B} , {B, C} , {^, B, C}} , (2.36) 

iP>i(/C) = {{A} , {B} , {C} , {A, C} , {^, B} , {B, C} , {^, B, C}} , (2.37) 

V>2{1C) = {{T, C7} , {A, B} , {B, C} , {71, B, C}} . (2.38) 

Let 5 be a set, and let ios be an |5|-partite state shared among parties specified by the elements 
of S. Let ^ be a partition of S. Then we use the shorthand 

Esc^iG)c. (2.39) 

to denote a multipartite squashed entanglement with grouping of parties according to the partition Q. 
For example, if cj = ojabc-, S = {A, B, C} and Qi = {{T} , {i?, C}}, then 

Esq{Gi)uj = Esq{A; BC)u}. (2.40) 

Similarly, if G 2 = {{^} j {-B} , {C*}}, then 

Esq{G2)Ld = Esq{A; B;C)u}. (2-41) 

We also employ similar shorthands for I, I, and Eg^. 


3 Auxiliary lemmas for the multipartite squashed entanglements 

3.1 Subadditivity 

The following lemma is a multipartite generalization of |43l Theorem 3], which was one of the 
main tools used to prove that the squashed entanglement of a quantum channel is an upper bound 
on its quantum capacity or private capacity when assisted by forward and backward classical 
communication. Naturally, the following lemma will be one of the important tools used to prove 
the main result in this paper. 

Lemma 6 (Subadditivity) For a {2m + 3)-partite pure quantum state '4’SPi-P,nQi-QmEiE2j ^he 
following subadditivity inequalities hold 

Esq{S;PiQi-,-■ ■ ■,PmQm)tlj<Esq{SQ[m]E2;Pi;--- Pm)tl} + Esq{S P[m]El-, Ql] ■ ■ ■ (3.1) 

Esq{S]PlQv,-■ ■ ; TWiQm)^; < -E'sq(5Q[m]£'2; Ti; • • • ; Pm)v; +-E'sq(*S'P[m]-Ei; Qi; • • • ]Qm)il}- (3.2) 

Proof. Let 


'^SPl-Prr,Ql-Q,nE[E2 “ ( V'SPl ■-P^ Ql') ) 

0'SPi-Pr„Qi-Q,„PiP' = 'SE2^E’2i'GsPi-P^Qi-QmEiE2), 

= ( 8 ) 5 e 2 ^ e ') i'GsPv-PmQi-Q^EiE2), 


‘^SPi-P™Qi-Q,„P;P' 
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(3.3) 

(3.4) 

(3.5) 


(3.6) 


where each S^-^e' is an arbitrary local squashing channel. Let 


SPl-PmQl-Q^E[E'2R 

be a purification of a; with purifying system R. 

We first prove (3.1). Consider the following chain of inequalities: 


‘^Esq{S; PiQi] • • • ; PmQm)^! 

<I{S-,PiQir-- ■,PmQm\E[E’2)^ 

m 

= Y, H{PiQi\E[E'^ )^ _ F (Pi • • • P^Qi • • • |SP(P' 

i=l 

m 

= Y H{PiQi \E'lE'^)^ + P (Pi • • • PmQl ■■■Qm\R)^ 

i=l 
m 

2 = 1 


+ p (Pi • • • p^ |p)^ + p (Qi • • • g™ |p)^ 


(3.7) 

(3.8) 

(3.9) 
(3.10) 


The first inequality follows from Definition The first equality follows from the definition of 
the quantum conditional multipartite information. The second equality follows from the duality 
of conditional entropy, namely, for a tripartite pure state 4>klm, P (P IL)^ = —P {K \M)^. The 
second inequality is a consequence of the strong subadditivity of quantum entropy I {K; L |M) > 0. 
Continuing from above. 


= YH{Pi \E[)^ - P (Pi • • • P^ |pgi • • • QmE[E'^)^ 
2=1 


m 

+ YP{Q^ \P2)^-H{Qi---Q^\SPi---PmE[E'^)^ 

2 = 1 

= l{SQi---Q^E'^-Pi--- - ]Pm\E[)^ + l{SPi---P^E[-Qr,--- 
< I {SQi • • • QmE2] Pi-,-- - ]Pm\E[)^ +I {SPi--- PmEi-, Qi; • • • 


; Qm |-^2 

; Qm 1 ^ 2 ) 0 - 


(3.11) 

(3.12) 

(3.13) 


The first equality follows from the duality of conditional entropy and the second from rewriting 
the linear sum of conditional entropies in terms of a multipartite conditional mutual information. 
The final inequality follows from the data processing inequality for the quantum conditional mul¬ 
tipartite information. Since the above calculations are independent of the choice of squashing 


channels Se-^e'j since Pi purifies the state on SPiQi 
on SPiQi • • • PmQmEi, the inequality in (3.1) follows. 


• PmQmE 2 and P 2 purifies the state 
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We now prove the inequality in (3.2). The proof idea is similar to the above, but we give it 
below for completeness. Consider the following chain of inequalities: 


2£'gq(S';PiQi; • • • ■,PmQm)'ip 

= H {SPiQi • • • PmQm\E[E!,)^ - H {S\PiQi ■ ■ ■ PmQmE[E'^)^ 

m 

{PmSP[m]\{i}Q[m]\{i]E[E'^)^ 

i=\ 

m 

= H (PiQi • • • P^Qm\E[E'^)^ -Y,E{PiQi\SP^^^\{i}Q^m]\{^}E[E'^)^ 

i=l 

m 

= H (PiQi • • • P^Qm\E[E'^)^ + (PiQilR)^ 

i=l 


(3.14) 

(3.15) 

(3.16) 

(3.17) 


The first inequality follows from the definition of Pgq. The first equality follows from expanding 
I with (2.16). The second equality follows from H {AB\C) — H {A\BC) = H {B\C) with A = S, 
B = PiQi ■ ■ ■ PmQm, and C = third equality follows from duality of conditional entropy. 

Continuing from above, 


< if (Pi • • • Pm\E[)^ + P (Ql • • • Qm\E',)^ + ^ P (P.|P)^ + P (Q.|P)^ 

i=l 

m 

= P (Pi • • • Pm\E[)^ + P (Qi • • • QmiPa), {P^\E[E’^SP[m]\{^}QlmY 

i=l 


m 

-YH {Qi\E[E'^SP[m]Q[m]\{i})^ 

i=l 

= l{SQi---QmE!2-,Prr-- ;Pm\E[)^ + I {SP^-■ ■ PmE[-Qr,- ■ ■ ;Q„^|P2)^ 
<l{SQi---QmE2-,Pr,--- ;Pm\E[)^ + l{SPi---PmEv,Qir-- 


(3.18) 


(3.19) 

(3.20) 

(3.21) 


The first inequality follows from several applications of the strong subadditivity of quantum entropy. 
Th e first equality is again duality of conditional entropy. The final equality is from the definition of I 
in (2.16) and the last inequality follows from the monotonicity of I under local quantum operations. 
Since the above calculations are independent of the choice of squashing channels since 

Pi purifies the state on SPiQi ■ ■ ■ PmQmE2 and P 2 purifies the state on 5PiQi • • • PmQmEi, the 
inequality in (3.2) follows. ■ 


3.2 Monotonicity under groupings 

Lemma 7 The squashed entanglement measures of Definition^ are non-increasing under grouping 
of subsystems, i.e., for a state PAi-AmJ 

Esq{Ai‘, • • • ; A^n)p > Psq {A1A2] ^ 3 ; ' ' ' J ^m)p 
Esq{Ai', • • • ; A^rfip P Psq {A1A2', ^ 3 ; ' ‘ ‘ J ^m)p 
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(3.22) 

(3.23) 






Proof. Consider the chain rule expansion for I{Ai] • • • ; Am)p given in (2.14): 


/(Ai;... ;Arn\E)^ = Y,H{Ai\E)^-H{Ai---Am\E)^ 

i=l 

m 

= H{A^\E)^ + H{A2\E)^ + Y,H{A,\E)^-H{Ai---Am\E)^. 

i=3 

Now consider the same chain rule expansion for I (^1^42; A^; • • • ; Am)p- 


I (^1^2; As-,-- - ■,A,n\E)p = H (^1^2 \E)^ + Y,H (Ai \E)^-H{Ai--- A^\E] 

i=3 

Taking the difference of ( |3.25 ) and (3.26), we find that 


I{Ai;--- -,Am\E)p — I{AiA2;As;--- -,Am\E)^ 
= H (^1 \E)^ + H (^2 \E)p-H (A1A2 \E)^ 

= I{Ar,A2\E)^ 

> 0 , 


(3.24) 

(3.25) 


(3.26) 


(3.27) 

(3.28) 

(3.29) 


where the last inequality follows from the strong subadditivity of quantum entropy. 

Similarly, consider the chain rule expansion for /(^i; • • • ; A^) given in (2.15). We have 


I {Ar, -- - ;Am\E)p = \E)^ - {m - 1) H {Ai - - - Am lE)^ (3.30) 

i=l 

= H{A2---Am\E)p + H{AiA3---Am\E)^ 

m 

+ (^H\{d l^)p -{m-'i-)H{Ai---Am \E)^ . (3.31) 

i=3 

Now consider the same chain rule expansion for I {A 1 A 2 -, A^-, - - - -,Am) where we have grouped 
systems Ai and A 2 into one system. We have 


I {AiA 2 -, As', - - - -, Am \E)p — H (A3 • • • Am \E)p 

m 

+ H \E) — {m — 2 ) H (Ai • • • Am \E)p . (3.32) 


i=3 


Taking the difference of ( |3.31 ) and (3.32), we find that 

I {Ay,-- - ; Am |7?)p — 7 (A1A2; A3; • • • -,Am\E)p 
= H{A2---Am\E)p + H{AiAs---Am\E)p 

-H{As---Am\E)p-H{Ai---Am\E)^ 
= I{AY,A2\As---AmE)p 
> 0 , 


(3.33) 

(3.34) 

(3.35) 


where the last inequality follows from the strong subadditivity of quantum entropy. The statement 
of the lemma follows from the above inequalities and by taking infima. ■ 
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3.3 Reduction for product states 

Lemma 8 Let ujAiA2---Am = PAi ® aA2-AmJ where pA^ and o'A2-Ajn density operators. Then 

Esq {Ai;A2-, • • • ; Am)^ = -Esq (^2; ^3; ' ' ' ; Am)^ , (3.36) 

Esq {Ai', A.2', • ■ ■ ; = Egq (^2) ^3) ‘ ‘ ‘ j A^n^fj ■ (3.37) 

Proof. We first prove LHS > RHS for the inequalities in the statement of the lemma. Consider 
that 


Esq {Ai-,A2] • • • ; Ara)^^ > Egq (^1^2; ' ' ' ; Am)i^ (3.38) 

^ Egq {A 2 ', • • • ; Ajn)i^ (3.39) 

= Esq {A 2 ', • • • ; Am)(j , (3.40) 

where the first inequality is from monotonicity under groupings (Lemma and the second inequal¬ 

ity is from monotonicity under LOCC. The same reasoning gives 

Esq (^i; ^ 2 ; • • • ; Am)^ > Esq (^ 2 ; ^3; ' ' ' ; ^m)o- ■ (3-41) 


We now prove LHS < RHS for the inequalities in the statement of the lemma. Let pa^e extend 
PAi and aA 2 -AmF extend aA 2 -A^- Then 


2Esq (^ 1 ; A 2 ] • • • ; Am)^ < I {A\] H 2 ; • • • ; H^jEE)^^^ (3.42) 

m 

= H (AilEE)^^^ + Y,H {Ai\EF)^^^ - H {A,A 2 • • • 7l^|EE)^^, (3.43) 


i=2 


HiA,\E)^ + J2HiAi\F)^-\H{A,\E)^ + HiA2---A^\F)] (3.44) 


i=2 


= Y,H (H,|E), - E (H2 • • • T^|E), (3.45) 

i=2 

= I{A2-r-- ]A^\F)^. (3.46) 

Since the calculation holds independently of the particular extension of cr, we can conclude that 

Esq {Ai]A2] • • • ; Am)^ < Esq {A 2 ] ■ ■ ■ \ Am)„ ■ (3.47) 
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For the other inequality, consider that 


(^i; ^2t ■ ■ ■ ; ^ I (^1) -^2] ' ' ' ! -^rn\EF) (3.48) 

= HiA,A2---A^\EF)^^^ 


m 

H {Ai\A 2 ■ ■ ■ AmEF)^^^ + X] ^ 

i=2 


= H{A,\E)^ + H[A2---Arn\F)^^^ 

(3.49) 

- 

III 

H (Ai\E)^ + Y^H (Ai\A\2M'Ai)F)^ 

i=2 

(3.50) 

= H{A2-- 

m 

■ ^rn\F)p^^ {Ai\A^2:m]\{i}E) ^ 

i=2 

(3.51) 

= I{A2c- 

• -^AmlE)^. 

(3.52) 

By the same reasoning as above, we 

can conclude 


Esc{ (Aij 7 

2) ■ ■ ■ ) ^m)(j ^ Egq (A 2 ; • • • ; Am)^- ■ 

(3.53) 


This completes the proof. ■ 


3.4 Multipartite squashed entanglements of maximally entangled states and 
private states 

Consider a set 5 = {^4, B, C}. Let abc be a joint state over A, B, and C of the form 


'^ABC = ^aWbW ® 4>^(2)c-{2) 


4>B{3)c(3) ® ^aWbWcW 

® 7a(5)B(5) ® 7 ^( 6 ) C(6) 


' 7s{7)c(7 ® 7^(8)5(8)c'{8), (3.54) 


where each <h represents a maximally entangled state of the form in (2.5) and each 7 represents 


a private state of the form in (2.10), and where the quantum system A, e.g., has been split into 
subsystems A^^'^ A^"^^ to segregate the different kinds of correlations that it holds 

with B and C. Thus, if S corresponds to a set of three parties Alice A, Bob B, and Charlie C, 
then the state ^ abc represents a collection of maximally entangled states and private states shared 
between all the non-trivial subsets of the parties, which are enlisted in the following set: 


V>2[S) = {{A, B} , {A, C} , {B, C} , {A, 5, C}} . 


(3.55) 


Let us denote the number of entangled bits and private bits shared between the three parties 
over the various elements of V>2{S) by the tuple {Eab, Eac, Ebc, Eabc, Kab, Kac, Kb c,Ka bc) 
(where E stands for “Entanglement” and K for “Key”). Then, for the state '^abc in ( 3.54| ), we 
have 


Eab^H 


, Eac^H 

> 

, Kac^H 


, Ebc = H 

) 

, Kbc = H 


, Eabc = Ef 
$ \ / $ 


, Kabc = H 


Kab^H 
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(3.56) 

(3.57) 











where H denotes the von Neumann entropy. Note that the quantity E^b, which, e.g., is the amount 
of entanglement shared between Alice and Bob, is to be understood as the amount of entanglement 
between the systems and Also, for the private 7 -states it is implicit that we are evaluating 
the entropies with respect to the key systems, so that the entropy is equal to the number of private 
bits in the state. 

Our goal in this section is as follows. For a given state ^abc of the form in (3.54), we want to es¬ 
tablish constraints relating the elements of the tuple {Eab, Eac, Ebc-, Eabc-, Kab, Eac, Ebci Eabc) 
using the multipartite squashed entanglement quantities discussed in Section 2.6 For this, we are 


interested in determining the multipartite squashed entanglements of '^abc with respect to various 
nontrivial partitions of S = {A, B,C}, which are given by 


Gi = {{A},{B,C}}, 

(3.58) 

G2 = {{AB},{C}}, 

(3.59) 

G3 = {{AC},{B}}, 

(3.60) 

Ga = {{A},{B},{C}}. 

(3.61) 


(Note that we have excluded the trivial partition ^5 = {5}.) 

For partition we obtain 

EsqiGl)'^ = Esq{Gl)qi (3.62) 

= E^q (^^(l)^(2)yl(4)^(5)^(6)^(8). ^(l)^(3)^(4)_g(5)_g(7)_g(8)(7(2)^(3)^(4)(^(6)(7(7)(7(8)^ 

(3.63) 

+ E,^{A^^'>-,B^% + + E,^{A^^^; B^^^C^% (3.64) 

> Eab + Eac + Eabc + Kab + Kac + Eabc- (3.65) 


The first equality follows because the two squashed entanglements are identical in the bipartite 
case. The second equality follows from the additivity of squashed entanglement with respect to 
tensor-product states and from Lemma The inequality follows from Lemma A similar line of 
reasoning for partitions G2 and Gs yields the following constraints: 

- E ' sq (^ 2 )' i ' = Esq{G2)-i> > Eac + Ebc + Eabc + Eac + Ebc + Eabc, ( 3 . 66 ) 

Esq (^ 3 )^ = Esc^ (^ 3 )^ > Eab + Ebc + Eabc + Eab + Ebc + Eabc- ( 3 . 67 ) 

Finally, for partition Gi, we obtain 

Esq{GAh = Esq A^"^^ A^^'^ A^^^ A^^^ A^^^] B^^^B^^'>B^^'>B^^^B^'^^B^^^ 

( 3 . 68 ) 

= .Fsq(A(i);B(^))$ + .Fsq(A(2);C(2))^ + ^,q(B(3);C(3))$ + F;,q(A(^);B(^);C'(^))$ 

+ E,^{A<^^'>-,B^% + + E,^{B^'^'>; ; B^^'>; 

( 3 . 69 ) 

3 3 

> Eab + Eac + Ebc + ^Eabc + Eab + Eac + Ebc + ^Eabc- ( 3 . 70 ) 
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The second equality follows from the additivity of squashed entanglement with respect to tensor- 
product states and from Lemma The inequality follows from Lemma Similarly, we also 
obtain 

- Esq (^ 4 )^ > Eab + Eac + Ebc + -^Eabc + Kab + Kac + Kbc + ^Eabc- (3-71) 


Since G 4 is a tripartition and the two multipartite squashed entanglements are not identical in 
general, we can pick the minimum of -Esq(^ 4 ) 4 ' and -E'sq(^ 4 ) 4 ' to give a tighter upper bound. 

The above analysis can be further extended to sets containing more than three elements. Con¬ 
sider a set of m -|- 1 elements, S = {A,Bi,... ,Bm}, for arbitrary but finite m. Let T 5 be the 
following state: 

'^‘5 = ® Tx:, (3.72) 

^eP>2(5) 


which is a tensor product of all possible entangled states and private states that could be shared 
between all subsets of the parties in S, with it understood that each /C has a set of distinct 
subsystems in the tensor product (as is the case for the example in ( |3.54 )). For a given subset 
JC €V> 2 {S), let Ejc denote the number of entangled bits (logarithm of the Schmidt rank) in the 
multiparty GHZ entangled state and let K/c denote the number of private bits in the private 
state 'jic- 


Definition 9 For a given nontrivial partition G of a set S, we define the set C(G) of sets by the 
following procedure. Let Xi ,..., denote all of the sets in the partitionQ. For each G V {Xi), 
..., Ta’iqi G V ('^|g|); form the set Lxx U • • • U Ex^g^ and add it to C(Q). At the end, remove the 
null set and any singleton sets. 


For example, for the partition Gi = {{H} , {B, C}} of 5 = {A, B, C}, this procedure leads to 

CiGi) = {{H, B} , {H, C} , {H, B, C}} . (3.73) 

Definition 10 For a given nontrivial partition G of a set S and an element M of C (G), we define 
the set A {A4,G) as 

A{M,G)^{Xf^M\ X &G}\{^}. (3.74) 

For example, for the partition Ga = {{^} , {B} , {C}} of 5 = {A, B, C}, we have 

C{Ga) = {{71, B} , {H, C} , {B, C} , {H, B, C}} . (3.75) 

Let us denote the elements of C(^ 4 ) as {Af 1 , A42, TWs, Af 4 } . Then, we have 

AiMuG 4 ) = {{A},{B}}, (3.76) 

A{M2 ,Ga) = {{A],{C]], (3.77) 

A{M^,Ga) = {{B],{C]], (3.78) 

A{Ma,Ga) = {{A],{B],{C]]. (3.79) 
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Lemma 11 Let S be a set of parties and let be the tensor product of states defined in 
Then for a given nontrivial partition Q of S, the squashed entanglements Esq{G)^ and Esq{G)^ 
from Definition constrain the number of entangled bits E_m and private bits K_m between the 
elements of G as follows: 

9 X] {Km + Em) < T^^T-^\Esq{G)-iis, Esq{G)-iis\ ■ (3.80) 

M£C{g) 

Proof. Let ^ be a nontrivial partition of S. We begin by considering Esq{G):iis- 

Esq{G)<iig = '^sq(^) 7 K) 

IC&P>2{S) 

= {Ksq{G)^jy4 E Esq{G)'y^) 

Mec(g) 

The first equality is a consequence of the additivity of squashed entanglement with respect to tensor 
product states. The second equality follows because i?sq(^)$K ~ -®sq(^) 7 K: = 0 if /C C for some 
X € G and the algorithm that constructs C{G) removes all such 1C. Now consider that 


(3.81) 

(3.82) 


2Esq{G):i>M = I{Q)^m 

= Y.n{xnMU^ 

x&g 

= E"(-^nMU^ 

xeg 

= IA(M,G)IEm. 


(3.83) 

(3.84) 

(3.85) 

(3.86) 


The first equality holds because any pure entangled state is not extendible, so that any extension 
system is product with it. The next equality is from the definition of d(G) (similar to (2.14) 
without the conditioning system). The third equality follows because the state ^m is pure. The 
final equality is a consequence of the definition of the set A (Ai,G) and the fact that for all € G, 
where ^ is a nontrivial partition of S, Xr\fA. C Ai and therefore H {X E Af )^^ equals the number 
of entangled bits in ^m- 

We now prove the following lower bound: 


Ksq{G)^M ^ 2 (3.87) 

which extends Lemmaj^and just applies the idea behind |lll Proposition 4.19] to this more general 
case. To do so, let us consider both the key and shield systems of and label them by M. and 
Af', respectively, so that we relabel ^^m as Jmm'- Then Jmm' i^as the following form: 

7mm' — ^MM'® PM') (3.88) 


where the twisting unitary is 


-1 

Kmm' 'y ^ ® Km’i 

i=0 


(3.89) 


17 





and where Kj^ is the number of private bits contained in 'Jmm'- extension 'Jmm'e of 7 mm' 
has the following form: 

7mM'E = Umm' (*^>1 ® PM'e) ( 3 . 90 ) 

where pm’E is some extension of pm'- Let 7)^1 ^ denote the following state: 

7m'e^^M'PM'e{U)^i)^ . ( 3 . 91 ) 

Then consider that 


H {MM'E)^ = H (M'F)^ = H (M'E)^, , (3.92) 

H{E)^ = (3.93) 

where we have used some well-known properties of the von Neumann entropy, namely that it is 
invariant under unitary transformations, it is additive on tensor product states and that it is zero 
for pure states. Then, for all i, we have 


H{MM'\E)^ = H{M'\E)^,. 

This allows us to conclude that 


H{MM'\E)^ 


2KM-1 


E 


1 

2^M 


H{M'\E) 


(3.94) 


(3.95) 


where we have simply rewritten the right hand side, since H [Ai'\E)^i is the same for all i. For all 
T G we have that 


H{[Xf^M] [X'r\M'] E)^ 


H{Xf^ M)^ + H{[X'f^ M'] E\ [X n M])^ 

2^M-l 

i =0 


(3.96) 

(3.97) 


where we have used X' to label the shield systems corresponding to the key systems in X. The 
first term in (3.97) follows because H {X r\ = H {X r\ the number of entangled bits in 

‘h_A 4 , which indeed equals the number of private bits in 7 . Thus, from ( |3.97[ ) and ( |3.93 ), we have 

1 


H [[X M\[x'r\ M']\E) =Km + 


2Km 


H{[X'nM'] \E) 




(3.98) 


The multipartite conditional mutual information of 7 across the partition Q of the key systems and 
the analogous partition Q' of the shield systems can thus be written as 


i{gg'\E)^ = 


> 


Y,H{[XnM][X'n M'] \E)^ - H {MM'\E)^ 

(3.99) 

1.4 (M,g}\ ifA, + E E 2L ^'1 IFy 

A’eS i 

(3.100) 

E 2L " X'X,. 

i 

(3.101) 


(3.102) 

\A{M,g)\KM. 

(3.103) 
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The first equality follows from the definition of conditional multipartite information in (2.14). The 
second equality follows from (3.97) and (3.98) and the definition of the set A{Ai,G). The third 
equality follows once again from the definition of conditional multipartite information in (2.14). 
Finally, the fourth inequality in (3.103) from the strong subadditivity of quantum entropy, namely 
that I {G'\E)^i > 0 for any quantum state 7 *. Since the inequality is independent of the particular 
extension of 77474 ', from the definition of the multipartite squashed entanglement in ([^, we can 
conclude (3.87). Putting together (3.81 )-(3.86) and (3.87), we find that 


Es^{Gh,>- \^{M,g)\{KM+EM) 


(3.104) 


MeC(g) 


Similarly, we have 


Esq{g)'i>s ~ {^^sq{g)^ic + Esq{g) 

!C£P>2(S} 


7/C 


+ Esq(g)yj^ 

MeCiG) 


(3.105) 

(3.106) 


The proof is similar to the proof of (3.104). Using the definition of 1(0) similar to ( 2.16| ) (except for 
the conditioning system) and that of the the multipartite squashed entanglement Egq in Definition 
and a similar line of reasoning as given before for (3.81 )-(3.86), we obtain 


2T'sq(^)'I'7V( ~ 

= HiSh^ -Y,HixnM\iS\X) n 
x&g 

x^g 

= \A{M,G)\Em- 


By the same reasoning used to conclude (3.98), we can conclude that 


H {[M\ [X n M]] [M'\ [X'r^M']] \E)^ = Km + Y. {m'\ [x'nM'] \E)^ 

Consider that 


E,^{g)^^>-\A{M,g)\KM. 


(3.107) 

(3.108) 

(3.109) 

(3.110) 

(3.111) 

(3.112) 
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This is because 


I{QG'\E),^^,^ = Y,H{[M\[XnM]] [>['\ [X'nU]] \E)^ 

x^g 

-{\A{M,G)\-l)H[MM'\E)^ 

= \A{M,g)\KM + H{M'\ [X'nM'] \E)^^ 

xeg i 

i 

= \A{M,g)\KM+Yl 

i 

>\AiM,g)\KM 


(3.113) 

(3.114) 

(3.115) 

(3.116) 


The reasons for these steps are similar to those used to justify (3.99)-(3.103), and we can then 
conclude (3.112). So this implies that 


Es^{ghs>l ^ \A{M,g)\{KM+EM) (3.117) 

Mec(g) 


Equations (3.104) and (3.117) together conclude the proof. 


4 Entanglement distillation and secret key agreement using a quan¬ 
tum broadcast channel 

A quantum broadcast channel is a CPTP map from one sender A to multiple receivers 

Bi, ..., Bm- Several communication tasks have already been considered for a quantum broadcast 
channel [Ml lisi ESI EZ], and in classical information theory, the secret-key agreement capacity of 
certain classes of point-to-multipoint noisy discrete memoryless channels has been characterized 
|14j and further generalizations have been obtained as well [201 [2T] . 

In this work, we are interested in bounding the achievable entanglement distillation and secret 
key agreement rates between any subset of the parties when using a quantum broadcast channel 
an arbitrarily large number of times, such that the sender and receivers are allowed to engage in 
an arbitrary number of rounds of LOCC between each channel use. It is customary to consider the 
paradigm of local operations and classical communication (LOCC) for entanglement distillation 
and local operations and public communication (LOPC) for secret key agreement. However, as 
mentioned in Section |2.4[ the approximate LOPC distillation of secret key is equivalent to the 
approximate LOCC distillation of private states [271 [26] ■ Therefore, the two tasks can be studied 
together under the common umbrella of LOCC. 

Let us now define a general protocol for secret key agreement and entanglement distillation 
by using a quantum broadcast channel and LOCC. For simplicity, we begin by considering the 
case in which we have a sender Alice and two receivers Bob and Charlie. The most general 
{n, Eab, EaCt Esc-, Eabc-, Eab, KaCt Ebc, Eabca) protocol to distill entanglement and secret 
key between all subsets of the parties, where {Eab-,Eac^Ebc-,Eabc-,Kab-,Kac:Kbc-,Kabc) de¬ 
notes a rate tuple, involves the following steps: 
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Figure 1: A general protocol for entanglement distillation and secret key agreement using LOCC 
and a quantum broadcast channel Ma-^bc with one sender and two receivers. The protocol uses 
the channel n times, and the primed registers represent “scratch” registers that each party uses for 
local processing. The state ^abc at the end is e-close in trace distance to the ideal state given 


in (3.54) 


1 . Alice, Bob, and Charlie engage in a round of LOCC to prepare a state ■ Necessarily, 

this state is separable with respect to the cut AiA'^ : B'^ : C'l- Set 2 = 1. 

2 . Alice transmits system Ai through the broadcast channel MAi^BiCi = A/a^bc, leading to 
the state 


a 


(d 




'ArBiB[CiC[ -AfAi^BiCi [Pa,A[B'C[^ 

Thus, the primed registers A'-B[C[ represent “scratch” registers of arbitrary size that the 
three parties can use for their local processing. 

3. Alice, Bob, and Charlie engage in a round of LOCC, leading to the state n, r" ■ 

Set i ■.= i + 1. 

4. If 2 < n, then go to step 2. Otherwise, Alice, Bob, and Charlie engage in a final round of 
LOCC to produce a state ^abc- The protocol is depicted in Figure 

At the end of the protocol, the state VLabc is e-close in trace distance to the ideal state ^abc 


given in (3.54): 


W^ABC — ^ ABcWi — (4T) 

Furthermore, the entanglement distillation and secret key agreement rates (similar to ( 3.56[ ) and 
(3.57), but with a factor of 1/n to take into account n uses of the channel) are given as 


Eab = -H (Ai)^ , 
n 

Kab = -H (As) , 
n ' 


Eac = -H (A2)^ , 
n 

Kac = -H (Ae) , 
n ' 


n 

Kbc = -H {BA , 
n ’ 


Eabc^-H{A^)^, (4.2) 
n 

Kabc = -H (As) , (4.3) 
n ’ 


where the entropies are once again evaluated with respect to the ideal state in (3.54) and for the 


private 7 -states, it is implicit that we are evaluating the entropies of the key systems (so that the 
entropy is equal to the number of private bits in the state). 

A rate tuple {Eab, Eac, Ebc, Eabc, Kab,Kac, Kbc, Kabc) is achievable if for all e > 0 and 
sufficiently large n, there exists an {n, Eab, Eac, Ebc, Eabc, Kab, Kac, Kbc, Kabc, £) protocol 
of the above form. The capacity region is defined to be the closure of the set of all achievable rates. 
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The main goal of this paper is to give an outer bound on the capacity region as defined above. 
As such, it is helpful to describe the action of the channel in each round by an isometric extension 
^'a c E 1 where Ei is an environment system. Including the environment systems, we then write 

the state at the conclusion of i steps of the protocol as ^a'b b'C C'e*^ where = Ei - ■ ■ Ei. It is 
also helpful to consider a system that purifies the state before the ith channel use, so that 


n(0 




(4.4) 


is a purification of P'a a'.b'c'e^-^ ' 

an isometric extension U-^._ 

The generalization of the above protocol to multiple parties is straightforward, so we only 
discuss the main points. The channel is MA^Bi-Bm let S = {A, Bi,..., Bm}- For a given 
subset K, G V> 2 {S), let Kfz denote the rate at which a |/C| multiparty secret key can be distilled 
between the members of 1C, and let Efc denote the rate at which a |/C| multiparty GHZ entangled 
state can be distilled between the members of 1C. The rate tuple is specified by {Ex:, ^k)x&v> 2 (S)' 

After each round of LOCC, the state is and after each channel use, the state is The 

state generated after the last round of LOCC is which is e-close to the ideal state given 


Let a 


(d 

A',B,B'CiC'EiR(i) 


denote the state which results from applying 


o(i) 


,^BiCiEi of the channel NA.^BiCi to the purification H^AiA'B'c'E'-^R^^' 


in (3.72). Achievable rates and the capacity region are defined in a similar way, and it is again 
helpful to consider environments resulting from an isometric extension 
AfA^Bv-Bm- 


■BmE 


of the channel 


5 Bounds on entanglement distillation and secret key agreement 
for a two-receiver quantum broadcast channel 


In this section, we establish constraints on achievable rates for entanglement distillation and secret- 
key agreement for a quantum broadcast channel with two receivers. The bounds are given in terms 


of the squashed entanglement measures of Section 2.6 


Theorem 12 Let Ma^bc be a quantum broadeast channel from a sender Alice to receivers Bob 
and Charlie. If the rate tuple {Eab, Eac, Ebc, Eabc, Kab, Eac, dCsc, Kabc) is achievable, then 
there exists a pure state fjiA with 


w!rbc — ■E'a^bc{4>ra), ( 5 . 1 ) 

such that the following bounds hold 

Eab + Kab + Ebc + Kbc + Eabc + Kabc < -Fsq {RC-B)^ ( 5 . 2 ) 

Eac + Kac + Ebc + Kbc + Eabc + Kabc < E^q {RB-, C)^ ( 5 . 3 ) 

Eab + Kab + Eac + Kac + Eabc + Kabc < E^q ( A ; BC)^ ( 5 . 4 ) 

Eab + Kab + Eac + Kac + Ebc + Kbc 


+ ^ {Eabc + Kabc) < min |.Fsq (A; C)^ , Ssq (A; H; C)^! . (5.5) 

The dimension of system R need not be any larger than the dimension of the channel input. 
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Proof. It is important to realize that since we allow all three parties to participate in each round 
of LOCC, the bounds we give on these rates should involve all three of them. Consider an arbitrary 
protocol as described in Section We work our way backwards through the protocol, starting at 
the end and unraveling it until we reach the beginning. The ideal state at the end of the protocol 
is ^ABC, as specified in ( 3.54[ ), and the actual state is ^Iabc, as described in Step 4 of Section]^ 
They are related by (4.1). Recall the partitions of {A,B,C} discussed in (3.58)-(3.61). 


We begin by considering the constraint in 
Consider that 


, which corresponds to the partition in (3.60). 


n {Eab + Kab + Ebc + Kbc + Eabc + Kabc) < -Esq [AC] B)^ (5.6) 

<E,^{AC-B)^ + h{n,e). (5.7) 


The first inequality follows from (3.67) and the second follows from an application of the continuity 
of squashed entanglement to (4.1), with fi (n,e) a function such that lim^^^o l™ri^oo {n,e) = 0 
(we will have more such functions later on). Continuing, we have that 

E,^iAC-,B)^ 

< Esq B^Bn) ^(n) 

< Esq {KC^CnBnEn, B'^) + Esq (^C^aE^Ei • • • Bn) ^ 

= Esq {KC'nAn. B'n )+ Esq (^C^C^E^Ei • • • ; E„) ^ 


-(") 


t{") 


< Esq (^An-iCn_iCn-l', Bn_iBn-l) + Esq i^A’nC'nCnB'nEi • • • En-lR^^^] B^ 

n 

< Y, Esq (A'fi[CiB[Ei • • • e / 


7(") 


(5.8) 

(5.9) 

(5.10) 

(5.11) 

(5.12) 


2=1 


The first inequality follows from monotonicity of the squashed entanglement under LOCC. The 
second inequality follows from applying Lemma The equality follows from the fact that systems 
An and BnCnEn are related by an isometry (i.e., an isometric extension of the channel). The 
third inequality is again monotonicity under LOCC. To conclude the final inequality, we repeat 
(5.9)-(5.11) iteratively. Putting the two inequality chains together, we find that 

Eab + Kab + Ebc + Kbc + Eabc + Kabc 


1 ” 

< - Esq (A'C'CiE'Ei • • • E,_iE(*); E, 

2=1 

= Esq(QSC';E), + -/i(n,e), 


+ -/i {n,e) 
7(') n 


where 


n ^ 

TQSBC = Y -\^'^\q®^A^BC 
2=1 




(5.13) 

(5.14) 

(5.15) 


and e/ib'.c'e e purification defined in (4.4), with it understood that systems EjCj 

are isomorphic to systems EC. In the above, Q is a time-sharing or auxiliary classical system, and 
S is a register with size 


|S| > max Tl'C'E'Ei • • • 


(5.16) 
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such that it is large enough to contain the largest of the systems A[C[B[Ei ■ ■ ■ (and simply 

padded with zeros for smaller systems). Observe that the state tqsbc is constructed from the 
given protocol. The equality in (5.14) follows from the application of LemmaThus, we arrive at 
a single-letter bound. 

A similar line of reasoning leads to the following inequalities: 


(5.17) 


Eac + Kac + Ebc + Kbc + Eabc + Kabc < Esq {QSB-, C) + -f 2 {n, e ), 

n 

Eab + Kab + Eac + Eac + Eabc + Eabc < Esq {QS-,BC) -I- -/s (n, e), (5.18) 

n 


where we observe that the constraints involve the same state tqsbc from (5.15). 

We now consider the constraint in (5.5). The reasoning that follows holds for both multipartite 
squashed entanglements Esq and Esq. The entanglement distillation and secret key agreement rates 
of any protocol can be upper bounded as follows: 


n ( Eab + Eab + Eac + Eac + Ebc + Ebc + ^ [Eabc + Eabc] 


^ Esq{A] B; C)^ < Esq{A‘, B] C)q, + (n, s), (5.19) 


where the first inequality is a consequence of (3.70) and the second from applying continuity of 
squashed entanglement to (4.1). Continuing, we find that 


t(") 


Esq(A;B;C)n 

< Esq (A^-, B^Bn] C^Cn) ^(n) 

< Esq {A'^CnBnEn, B'^; + Esq (A'^B'^C'^Ei • • • En-lR^^'> ] B^, Cn 

= Esq (KAn, B '^-+ Esq {a'^B'^C'^E^ • • • B^, 

< Esq (A;_i; B'^_,Bn-i; + Esq [a'^B'^C'^E^ • • • Cn)^ 

n 

< Y, Esq {a',B[C[E^ • • • Ei_iR^^^-,Bi- Ci' 


.(n) 


(5.20) 

(5.21) 

(5.22) 

(5.23) 

(5.24) 


2=1 


Putting the above two inequality chains together, we find that 


Eab + Eab + Eac + Eac + Ebc + Ebc + ^ {Eabc + Eabc) 


< 


n 


n ^ 

V Esq (a'.B'C'Ei • • • Be, Ci) + -U (n, e) 

^^ V / cr(^) n 

i=l 


= Esq{QS-,B;C)^ + -h{n,e), (5.25) 


n 


where r is defined in (5.15). By the same reasoning, we have that 


Eab + Eab + Eac + Eac + Ebc + Ebc + ^ {Eabc + Eabc) 


<Esq{QS-,B-,C)^ + -h{n,e), (5.26) 

n 
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Note that unlike in the bipartite case, in the multipartite case with three or more parties 
have the two possible squashed entanglement measures -Esq and Egq. Since in general they are 
incomparable, either could give a tighter bound. 

The assumption that the rate tuple {Eab, Eac-, Ebc-, Eabc, Kab, Eac, KbCj Kabc) is achiev¬ 
able implies that we can take e 0 as n —>■ oo. So we have shown that the rate tuple satisfies 


(5.2)-(5.5) for some input state pra and ojrbc = J^A^BciPRA)- Let 4>%ra be a purification of pra 
and let ujr'rbc = E'a-^bc{4>'rira)- Ly monotonicity of squashed entanglement under quantum 
operations, we have that 


Esq (EC; B)^ < Esq (E'EC; B)^ , (5.27) 

Esq (EE; C), < Esq (E'EE; C)^ , (5.28) 

Esq (E; BC)^ < Esq (E'E; BC)^ , (5.29) 

Esq (E; E; C)^ < Esq [R'R; E; C)^ , (5.30) 

Esq (E; E; C), < Esq (E'E; E; C)^ . (5.31) 


By the Schmidt decomposition, note that we can take |EE'| = |^|. The dimension bound appearing 
in the statement of theorem comes about by redefining R := EE'. ■ 


6 Bounds on entanglement distillation and secret key agreement 
for an m-receiver quantum broadcast channel 

Let RfA^Bi-Bm be a quantum broadcast channel with one sender A and m receivers Ei, ..., 
Bm- Let S = {E, El,..., E^}, where E is a system that the sender possesses. For a given subset 
/C G E> 2 ( 5 ), let Kic denote the rate at which a \JC\ multiparty secret key can be distilled between 
the members of fC, and let Ej^ denote the rate at which a |/C| multiparty GHZ entangled state can 
be distilled between the members of 1C. We now state our main theorem: 

Theorem 13 If the rates {Kjc, are achievable, then there exists a pure state 4>ra with 

^^RBi-Brr, ^ ■E'A^Bi-Bmi4’RA), ( 6 . 1 ) 

such that the following bounds hold. For all partitions Q of S, 

^ ^ \A{M,g)\{KM + Em) <^i.A(Esq{G)aj, Esq{g)aj\ , (6.2) 

M&C{g) 

and 

A{M,g) = {Xr\M\ X ^Q}\{%]. (6.3) 

The dimension of system R need not be any larger than the dimension of the channel input. 

Proof. We sketch a proof of this theorem, which proceeds along the lines of reasoning employed 
in proving Theorem |12[ The proof involves the following steps, again working backwards through 
the protocol: 
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1. Let ^ be a partition of S. The ideal state at the end of the protocol is T 5 , as given in (3.72). 
Lemma 11 establishes the following bound: 


I ^ \A{M,g)\{KM+E m) ■ (6.4) 

Mec(g) 


2. The actual state generated by the protocol is fis, as specified in Section]^ Use the fact that 
fis is e-close to T 5 and the continuity of squashed entanglement to establish that 

Esq(Q)^^ < Esq(Q)n^ + fg {u, e) , (6.5) 

L'sq(^)'I '5 < Esq{G)n^ + fg {tL, e) , (6.6) 

for fg (n, e) some function with the property that lim^^o ^ fg (n, s) = 0 . 

3. Use the fact that the squashed entanglement is non-increasing under LOCC. 

4. Invoke the subadditivity lemma (Lemma [^. 

5. Invert the action of the channel on the ith input to replace BiCiEi —)> Ai since the systems 
BiCiEi and Ai are related by an isometric extension of the channel. 


6 . 

7. 


Iterate Steps 3-5 for every step of the protocol. 

As in (5.25), use Lemma|^to rewrite the linear sum of squashed entanglements as the squashed 
entanglement of a single state to obain a single letter bound. We can use the same reasoning 
as at the end of the proof of Theorem |12| to restrict the input state to be pure. 


That concludes the proof sketch. ■ 


7 Application to a pure-loss bosonic broadcast channel 


We now apply our results to a pure-loss bosonic broadcast channel, generalizing prior results for 
the single-sender single-receiver case |43| 142] . For simplicity, we consider a one-sender two-receiver 
channel from a sender Alice to receivers Bob and Charlie. However, note that the methods given 


here can be combined with Theorem 13 to determine bounds for an arbitrary number of receivers. 
A pure-loss bosonic channel of the above type can be modeled as 


b = y/m o' 


'r/ B(l -rjB - rjc) 
riB + VC 


f + 


VC 


VB + VC 


c 

e 


VC A - VB- VC) 


f + 


-V^a' - 

V VB +VC 
--\/l - VB - VC a +VVB + VC f, 




VB + V< 


(7.1) 

(7.2) 

(7.3) 


where o', b, c, e are annihilation operators for Alice’s input, Bob’s output, and Charlie’s output 
modes, respectively, / and g are annihilation operators for vacuum inputs from the environment, 
and the vb, Vc > ^ ore transmission coefficients such that vb + Vc < 1- The model generalizes 
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the bosonic broadcast channel from prior work |23l |23] , in that all of the light does not necessarily 
make it to the two receivers and that which does not is given to the eavesdropper. 

In any protocol for entanglement distillation and secret key agreement, we assume that the 
final step of the protocol outputs a finite-dimensional state, i.e., the goal is to generate maximally 
entangled states of finite Schmidt rank and finite-dimensional private states. This is a common 
approach in continuous-variable quantum information theory [23113 Eni El], simply because both 
quantum capacity and private capacity are measured in qubits and private bits per channel use, 
respectively. This approach furthermore provides a mathematical convenience: the only aspect of 
our analysis here which requires finite-dimensional states is when we apply continuity of squashed 
entanglement at the end of the protocol. All other steps rely on properties of entropy or the quantum 
data processing inequality, which is known to hold in very general settings |46j . Furthermore, we 
begin by assuming that each channel input has a mean photon number constraint < Ns for 

some Ns such that 0 < Ns < oo, but we eventually take a limit as Ns —)> oo, indicating that our 
bounds are photon-number independent as is the case in |43L 142] . 

We then need to determine the (multipartite) squashed entanglement. In this regard, it is not 
necessarily an easy task to optimize over all possible squashing channels of Eve. However, since 
any squashing channel can be used to give an npper bound for the rates, we choose to optimize 
over squashing channels that are also pure-loss bosonic channels, modeled by a beamsplitter given 
by the following mode transformation: 

e VWe + v/l - VE'f', VE' e [0,1] . (7.4) 

We begin by stating and proving the following proposition, which is more general than what 
we need, but the proof indicates a general approach that we employ to establish the main theorem 
of this section. 

Proposition 14 Let a pure-loss bosonic broadcast channel from a sender A to m 

receivers Bi, ..., Bm with transmission coefficients r]i > 0 for all i G m}, such that 

m 

p = Y,Vi<L (7.5) 

i=l 

Then the following upper bound holds for the squashed entanglements of the bosonic broadcast 
channel 


max < sup Esq (E; Ei; • • • ]Bm)^, sup Esq (E; Ei; • • • ; B^)^ 

I <I>RA 4>RA 


1 

< - 
“ 2 


Vi 




1 -Flog 


(1 -v){l- 1 ]%,) 


+ 1 


where 

and rjf,, is the solution of 


WiRBl-Bm = -^A^Bi-Bm {4 >Ra) , 


V"_ t _=_ t _ 

^ V%' {'^-v) /vi + Ve’ (1 - PE' f (1 - '^) /h + 1 - Ve' 


(7.6) 

(7.7) 


(7.8) 


27 









Proof. Our proof of this proposition generalizes the proof of |l3l Eq. (27)]. Let be the 

pure state that results from applying the channel to a pure state input (I)ra satisfying <^a^a) , < Ns- 

Let ^RBi--BmE'F' be the state resulting from applying the squashing transformation in ( |7.4[ ) to the 
system E of ^Prbi-b^e- Then 

m 

(i?; i?i; • • • ; < H {R\E')^ + F {Bi\E')^ - H {RB^ 

i=l 
m 

i=l 
m 

i=l 

As written, the conditional entropies in the last line are now functions of the input density operator 
4>a- Applying the extremality of Gaussian states for the conditional entropy dZl [52] , we can 
conclude that these quantities are all optimized by a thermal state of mean photon number Ns- 
For such a state, one can work out using the symplectic formalism for bosonic states [l8| that 


H {B,E') = 5 ([ry, + (1 - r?) ry^,] Ns) , (7.12) 

H{E')=g{{l-r,)r^E'Ns), (7.13) 

H{Bi--- BmE') =g{[g + {l- g) (1 - ryg,)] Ns) , (7.14) 

H{E')=g{{l-g){l-gE')Ns), (7.15) 

where 

g{x) = (x + 1) log 2 (x + 1) — X log 2 X (7.16) 


is the entropy of a thermal state of mean photon number x. Each entropy above can be understood 
in a simple way: for a simple pure loss bosonic broadcast channel N'A^BiB 2 ...Bm^ each state held 
by any group of parties at the receiving end is unitarily equivalent to a thermal state with mean 
photon number proportional to the fraction of light that makes it to them. So this leads to the 
photon-number dependent upper bound 


(7.9) 

(7.10) 

(7.11) 


2Esq {R;Bi;--- ; B^)^ ^ X] ( ^ + (1 “ Ve'] Ns) - g {{I - g) Ve’Ns) j 

i=l ^ ' 

+ 5 ([^ + (1 - v) (1 - VE')] Ns) -g{{l- g) (1 - VE') Ns) . (7.17) 

One can easily compute the derivative of g{x) — g (Ax) to show that this function is monotonically 
increasing in x for x > 0 and A G [0,1], and furthermore, one can easily show that 


lim g'(x) — (y (Ax) = log (1/A). (7-18) 

So we can conclude that the right hand side (RHS) above is a monotonically increasing function of 
Ns > 0 and taking the limit Ns —>• oo only increases the upper bound. This leads to the following 
photon-number independent upper bound: 


2Esq (i?; Bi] • • • ; Bm)i^ < ^ ^ log 

^=1 


Vi 


(1 - g) gE' 



+ log 


{l-g){l-gE') 



(7.19) 
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which holds for arbitrary 77 ^' £ [0,1]- To get the tightest upper bound, we should minimize the 
RHS of (7.19) with respect to rjE'- Any local minimum of this function is a global minimum because 
the function log (1 + a/x) is convex in x for a > 0 and x > 0 (as can be checked by computing the 
second derivative) and the RHS of (7.19) is convex in rjE' as it is a sum of convex functions. Since 
we need to solve for r]Ei in 


d 


dr]E' 


^log 


. 2=1 




(1 - ri) r^E' 


+ 1 + log 


V 


(l-ri) (l-rjE') 


1 


= 0 , 


(7.20) 


we can use that the first derivative of log(l + a/x) is equal to —1/ (x^/a + x), which leads to 
solving the following equation for tie'- 


E 


^ Te' (1 - v) /Vi + VE' (1 - VE') (1 - ^) /^? + 1 - VE' 


(7.21) 


This establishes one of the inequalities in ( |7.6[ ). 

By a similar line of reasoning as above, consider that 

2Esq{R;Bi-,--- ;Bm)^ 

m 

< H {RB, • • • BJE') - H {R\Bi • • • B^E') - ^ 77 {B,\RB[^^\{,^E’) 


2 = 1 




(7.22) 

(7.23) 


2=1 


Here again we have written the entropies as a function of the input density operator, which we 
know from the extremality of Gaussian states is optimized by a thermal state for a fixed photon 
number. For such an input, we have that 


77 (Hi • • • BmE') =g{[rj + {l- 77 ) 77 ^,] Ng ), 

77 (77') =g{{l- v) ve'Ns) , 

77 {BiEf) = g ([ 77 i + (1 - 77 ) (1 - ^e')] Ng) 
H{El)=g{{l-g){l-gE')Ng), 


(7.24) 

(7.25) 

(7.26) 

(7.27) 


so that (7.23) is bounded from above by 
g ([77 + (1 - 77 ) 77 e/] Ng) - g{{l- 77 ) gE'Ng) 


+ ^ (5 {[m + (1 - ^) (1 - VE')] Ns) - ((1 - v) (1 - VE') Ng) ^ 

2=1 ^ ^ 


m 

< 

2=1 


Vi 


( 1 - 77 ) {1-gE') 


+ 1 + log 


77 


(1 - 77 ) r]E' 


+ 1 


(7.28) 


This bound applies for every r]E' £ [0,1], so we can take a minimum over all such rjE'- However, 
we can now observe that this minimum is exactly the same as the one above because the RHS of 
(7.28) is related to the RHS of (7.19) by ^e' 1 — 77 ^/. ■ 
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We now state the main theorem of this section, which bounds the entanglement distillation 
and secret key agreement rates achievable with a pure-loss bosonic broadcast channel that has one 
sender and two receivers. 


Theorem 15 Let a pure-loss bosonic broadcast channel from a sender Alice to receivers Bob and 
Charlie be described by the mode transformations in (7.1)-(7.3). Then the achievable entanglement 
distillation and secret key agreement rates (see Section ^ are bounded as follows: 


Eab + Kab + Esc + Kbc + Eabc + Kabc < log 
Eac + Kac + Ebc + Kbc + Eabc + Kabc < log 
Eab + Kab + Eac + Kac + Eabc + Kabc < log 


I + VB - VC 
I-VB - VC 
^ + VC -VB 
I-VB - VC 
I + VB + VC 
I-VB - VC 


(7.29) 

(7.30) 

(7.31) 


and 


3 

Eab + Kab + Eac + Kac + Ebc + Kbc + a {Eabc + Kabc) 


1 

< - 
“ 2 


log 


VB 


(1 - 77) (1 - Ve ) 


1 -b log 


VC 


(1 - r?) (1 - r?!;,) 


+ 1 ] -b log 


(1 - v) vh 


+ 1 


where v*e' is the solution of 
1 


i|, {l-r])/r]B + VE’ ^ Ve' {'^-v)/VC + VE' (1 - VE'f (1 - r?) /r/ -b 1 - VE' 


Te 


(7.32) 


(7.33) 


Proof. Here we only highlight the main steps without giving reasons, as much of it is the same 
as in the proof of Proposition 14 Our approach is simply to bound the quantities i7sq {RC;B)^, 
Esq {RB; C)^, Esq {R; BC)^, Esq {R] B; C)^ from Theorem 12 Consider that 


2Esq iRC-,B)^<l{RC-,B\K) 


= H {B\E') - H {B\RCE') 
= H{B\E') +H{B\F') 

^ 1 / VB 

< log 


(1-77) VE ' 
Picking r]E' = 1/2 then gives the bound: 


Esq {RC; B)^ < log 


2t7b 

1 — 7 / 


+ 1 = log 


-b 1 + log 


2r] B + 1 - V 

1 — 77 


VB 


{I - g) {I - VE’) 


+ 1 


= log 


I + VB - VC 
I - VB - VC 


(7.34) 

(7.35) 

(7.36) 

(7.37) 


(7.38) 


This is optimal because the function in (7.37) is convex in 77 ^/ and symmetric about ve’ = 1/2. 
Similarly, we have 


Esq {RB; C)^ < log 


^ + VC - VB 
I- VB - VC 


TP ( T? ^1 f ^ + VB + VC 

Esq {R; BC)^ < log -- 

\l-VB-VC 


(7.39) 
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Furthermore, we can apply Proposition |14| to find that 

+ ‘“<5 (d _,)"‘i _,j^,) +') + ‘“s ((T^)* ^ 0 

where r]*^, is the solution of 

1 1 _ 1 
/vb + Ve' r]l, [1-7])/r]c + r]E' {1 - r/E'f (I - v)/v + - Ve'' 

This completes the proof. ■ 

8 Conclusion 

We have shown how multipartite generalizations of the squashed entanglement [MIE] lead to several 
constraints on the rates at which secret key and entanglement can be generated between any subset 
of the users of a quantum broadcast channel. Along the way, we developed several new properties of 
these measures, which include the subadditivity lemma (Lemma [^, monotonicity under groupings, 
reductions for product states, and the evaluation of the measures for a tensor product of entangled 
and private states shared between all subsets of a given set of parties. Finally, we applied our 
results to a single-sender two-receiver bosonic broadcast channel. 

Some future directions include to determine upper bounds on the secret key agreement and 
entanglement distillation capacity of a multiple access or more general quantum network channel. 
One could also attempt the challenging task of proving that the bounds given here are strong 
converse rates. However, it is not yet known whether the single-sender single-receiver squashed 
entanglement is a strong converse rate. 
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